CVE-2022-43776: Metabase

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects.

Affected products

• Metabase Metabase: before 0.44.5 (fixed in 0.44.5)

Published 2022-10-26. Last modified 2026-06-17.